1448 lines
143 KiB
XML
1448 lines
143 KiB
XML
<stix:STIX_Package
|
|
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
|
|
xmlns:cybox="http://cybox.mitre.org/cybox-2"
|
|
xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
|
|
xmlns:ASObj="http://cybox.mitre.org/objects#ASObject-1"
|
|
xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
|
|
xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1"
|
|
xmlns:EmailMessageObj="http://cybox.mitre.org/objects#EmailMessageObject-2"
|
|
xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"
|
|
xmlns:HTTPSessionObj="http://cybox.mitre.org/objects#HTTPSessionObject-2"
|
|
xmlns:HostnameObj="http://cybox.mitre.org/objects#HostnameObject-1"
|
|
xmlns:MutexObj="http://cybox.mitre.org/objects#MutexObject-2"
|
|
xmlns:PipeObj="http://cybox.mitre.org/objects#PipeObject-2"
|
|
xmlns:URIObj="http://cybox.mitre.org/objects#URIObject-2"
|
|
xmlns:WinRegistryKeyObj="http://cybox.mitre.org/objects#WinRegistryKeyObject-2"
|
|
xmlns:marking="http://data-marking.mitre.org/Marking-1"
|
|
xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"
|
|
xmlns:et="http://stix.mitre.org/ExploitTarget-1"
|
|
xmlns:incident="http://stix.mitre.org/Incident-1"
|
|
xmlns:indicator="http://stix.mitre.org/Indicator-2"
|
|
xmlns:ttp="http://stix.mitre.org/TTP-1"
|
|
xmlns:ta="http://stix.mitre.org/ThreatActor-1"
|
|
xmlns:stixCommon="http://stix.mitre.org/common-1"
|
|
xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
|
|
xmlns:stix-ciqidentity="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1"
|
|
xmlns:snortTM="http://stix.mitre.org/extensions/TestMechanism#Snort-1"
|
|
xmlns:stix="http://stix.mitre.org/stix-1"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xmlns:="https://rufus.citlab.utoronto.ca"
|
|
xmlns:xal="urn:oasis:names:tc:ciq:xal:3"
|
|
xmlns:xnl="urn:oasis:names:tc:ciq:xnl:3"
|
|
xmlns:xpil="urn:oasis:names:tc:ciq:xpil:3"
|
|
xsi:schemaLocation="
|
|
http://cybox.mitre.org/common-2 http://cybox.mitre.org/XMLSchema/common/2.1/cybox_common.xsd
|
|
http://cybox.mitre.org/cybox-2 http://cybox.mitre.org/XMLSchema/core/2.1/cybox_core.xsd
|
|
http://cybox.mitre.org/default_vocabularies-2 http://cybox.mitre.org/XMLSchema/default_vocabularies/2.1/cybox_default_vocabularies.xsd
|
|
http://cybox.mitre.org/objects#ASObject-1 http://cybox.mitre.org/XMLSchema/objects/AS/1.0/AS_Object.xsd
|
|
http://cybox.mitre.org/objects#AddressObject-2 http://cybox.mitre.org/XMLSchema/objects/Address/2.1/Address_Object.xsd
|
|
http://cybox.mitre.org/objects#DomainNameObject-1 http://cybox.mitre.org/XMLSchema/objects/Domain_Name/1.0/Domain_Name_Object.xsd
|
|
http://cybox.mitre.org/objects#EmailMessageObject-2 http://cybox.mitre.org/XMLSchema/objects/Email_Message/2.1/Email_Message_Object.xsd
|
|
http://cybox.mitre.org/objects#FileObject-2 http://cybox.mitre.org/XMLSchema/objects/File/2.1/File_Object.xsd
|
|
http://cybox.mitre.org/objects#HTTPSessionObject-2 http://cybox.mitre.org/XMLSchema/objects/HTTP_Session/2.1/HTTP_Session_Object.xsd
|
|
http://cybox.mitre.org/objects#HostnameObject-1 http://cybox.mitre.org/XMLSchema/objects/Hostname/1.0/Hostname_Object.xsd
|
|
http://cybox.mitre.org/objects#MutexObject-2 http://cybox.mitre.org/XMLSchema/objects/Mutex/2.1/Mutex_Object.xsd
|
|
http://cybox.mitre.org/objects#PipeObject-2 http://cybox.mitre.org/XMLSchema/objects/Pipe/2.1/Pipe_Object.xsd
|
|
http://cybox.mitre.org/objects#URIObject-2 http://cybox.mitre.org/XMLSchema/objects/URI/2.1/URI_Object.xsd
|
|
http://cybox.mitre.org/objects#WinRegistryKeyObject-2 http://cybox.mitre.org/XMLSchema/objects/Win_Registry_Key/2.1/Win_Registry_Key_Object.xsd
|
|
http://data-marking.mitre.org/Marking-1 http://stix.mitre.org/XMLSchema/data_marking/1.1.1/data_marking.xsd
|
|
http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1 http://stix.mitre.org/XMLSchema/extensions/marking/tlp/1.1.1/tlp_marking.xsd
|
|
http://stix.mitre.org/ExploitTarget-1 http://stix.mitre.org/XMLSchema/exploit_target/1.1.1/exploit_target.xsd
|
|
http://stix.mitre.org/Incident-1 http://stix.mitre.org/XMLSchema/incident/1.1.1/incident.xsd
|
|
http://stix.mitre.org/Indicator-2 http://stix.mitre.org/XMLSchema/indicator/2.1.1/indicator.xsd
|
|
http://stix.mitre.org/TTP-1 http://stix.mitre.org/XMLSchema/ttp/1.1.1/ttp.xsd
|
|
http://stix.mitre.org/ThreatActor-1 http://stix.mitre.org/XMLSchema/threat_actor/1.1.1/threat_actor.xsd
|
|
http://stix.mitre.org/common-1 http://stix.mitre.org/XMLSchema/common/1.1.1/stix_common.xsd
|
|
http://stix.mitre.org/default_vocabularies-1 http://stix.mitre.org/XMLSchema/default_vocabularies/1.1.1/stix_default_vocabularies.xsd
|
|
http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1 http://stix.mitre.org/XMLSchema/extensions/identity/ciq_3.0/1.1.1/ciq_3.0_identity.xsd
|
|
http://stix.mitre.org/extensions/TestMechanism#Snort-1 http://stix.mitre.org/XMLSchema/extensions/test_mechanism/snort/1.1.1/snort_test_mechanism.xsd
|
|
http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.1.1/stix_core.xsd
|
|
urn:oasis:names:tc:ciq:xal:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xAL.xsd
|
|
urn:oasis:names:tc:ciq:xnl:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xNL.xsd
|
|
urn:oasis:names:tc:ciq:xpil:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xPIL.xsd" id=":Package-4fc9013b-312e-4062-a2f4-9ff6621eb98c" version="1.1.1" timestamp="2017-12-06T16:16:33.380179+00:00">
|
|
<stix:STIX_Header>
|
|
<stix:Title>Export from MISP</stix:Title>
|
|
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
|
|
</stix:STIX_Header>
|
|
<stix:Related_Packages>
|
|
<stix:Related_Package>
|
|
<stix:Package id=":STIXPackage-5a27f994-d7c0-4ef0-9b8f-40758e96ca05" version="1.1.1" timestamp="2017-12-06T11:04:20+00:00">
|
|
<stix:STIX_Header>
|
|
<stix:Title>Champing at the Cyberbit: Ethiopian Dissidents Targeted with New Commercial Spyware (MISP Event #125)</stix:Title>
|
|
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
|
|
</stix:STIX_Header>
|
|
<stix:Incidents>
|
|
<stix:Incident id=":incident-5a27f994-d7c0-4ef0-9b8f-40758e96ca05" timestamp="2017-12-06T11:04:35+00:00" xsi:type='incident:IncidentType'>
|
|
<incident:Title>Champing at the Cyberbit: Ethiopian Dissidents Targeted with New Commercial Spyware</incident:Title>
|
|
<incident:External_ID source="MISP Event">125</incident:External_ID>
|
|
<incident:Time>
|
|
<incident:Incident_Discovery precision="second">2017-12-05T00:00:00+00:00</incident:Incident_Discovery>
|
|
<incident:Incident_Reported precision="second">2017-12-06T11:04:35+00:00</incident:Incident_Reported>
|
|
</incident:Time>
|
|
<incident:Status xsi:type="stixVocabs:IncidentStatusVocab-1.0">Closed</incident:Status>
|
|
<incident:Related_Indicators>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-15cc-44d6-8153-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: 568d8c43815fa9608974071c49d68232 (MISP Attribute #17544)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: 568d8c43815fa9608974071c49d68232 (MISP Attribute #17544)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-15cc-44d6-8153-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-15cc-44d6-8153-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">568d8c43815fa9608974071c49d68232</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-4ac4-49c5-9c46-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: 80b7121c4ecac1c321ca2e3f507104c2 (MISP Attribute #17545)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: 80b7121c4ecac1c321ca2e3f507104c2 (MISP Attribute #17545)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-4ac4-49c5-9c46-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-4ac4-49c5-9c46-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">80b7121c4ecac1c321ca2e3f507104c2</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-b378-4812-adc5-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: 8d6ce1a256acf608d82db6539bf73ae7 (MISP Attribute #17546)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: 8d6ce1a256acf608d82db6539bf73ae7 (MISP Attribute #17546)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-b378-4812-adc5-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-b378-4812-adc5-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">8d6ce1a256acf608d82db6539bf73ae7</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-e53c-422a-81bf-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: 840c4299f9cd5d4df46ee708c2c8247c (MISP Attribute #17547)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: 840c4299f9cd5d4df46ee708c2c8247c (MISP Attribute #17547)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-e53c-422a-81bf-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-e53c-422a-81bf-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">840c4299f9cd5d4df46ee708c2c8247c</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-de5c-4a30-8d45-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: 961730964fd76c93603fb8f0d445c6f2 (MISP Attribute #17548)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: 961730964fd76c93603fb8f0d445c6f2 (MISP Attribute #17548)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-de5c-4a30-8d45-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-de5c-4a30-8d45-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">961730964fd76c93603fb8f0d445c6f2</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-bc88-4421-a137-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: 376f28fb0aa650d6220a9d722cdb108d (MISP Attribute #17549)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: 376f28fb0aa650d6220a9d722cdb108d (MISP Attribute #17549)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-bc88-4421-a137-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-bc88-4421-a137-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">376f28fb0aa650d6220a9d722cdb108d</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-88bc-43fe-8b35-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: ca782d91daea6d67dfc49d6e7baf39b0 (MISP Attribute #17550)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: ca782d91daea6d67dfc49d6e7baf39b0 (MISP Attribute #17550)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-88bc-43fe-8b35-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-88bc-43fe-8b35-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">ca782d91daea6d67dfc49d6e7baf39b0</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-84fc-42ff-b5b6-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: 0488cf9c58f895076311bf8e2d93bf63 (MISP Attribute #17551)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: 0488cf9c58f895076311bf8e2d93bf63 (MISP Attribute #17551)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-84fc-42ff-b5b6-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-84fc-42ff-b5b6-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">0488cf9c58f895076311bf8e2d93bf63</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-80d8-4fdb-a65b-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: f483fe294b4c3af1e3c8163200d60aae (MISP Attribute #17552)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: f483fe294b4c3af1e3c8163200d60aae (MISP Attribute #17552)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-80d8-4fdb-a65b-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-80d8-4fdb-a65b-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">f483fe294b4c3af1e3c8163200d60aae</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-6a58-470b-a448-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: 1dcff300018c37a888fbe36f270f43a7 (MISP Attribute #17553)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: 1dcff300018c37a888fbe36f270f43a7 (MISP Attribute #17553)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-6a58-470b-a448-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-6a58-470b-a448-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">1dcff300018c37a888fbe36f270f43a7</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-737c-4b9b-a821-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: ed42fcd0ae2e1baf3d0eead4fcf9c9da (MISP Attribute #17554)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: ed42fcd0ae2e1baf3d0eead4fcf9c9da (MISP Attribute #17554)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-737c-4b9b-a821-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-737c-4b9b-a821-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">ed42fcd0ae2e1baf3d0eead4fcf9c9da</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-5cfc-4111-b71a-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: 4b6d030664668224a88ca260354e5b4e (MISP Attribute #17555)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: 4b6d030664668224a88ca260354e5b4e (MISP Attribute #17555)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-5cfc-4111-b71a-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-5cfc-4111-b71a-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">4b6d030664668224a88ca260354e5b4e</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-561c-42c6-8c04-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: 94d49232f1d77611544371826be16a99 (MISP Attribute #17556)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: 94d49232f1d77611544371826be16a99 (MISP Attribute #17556)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-561c-42c6-8c04-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-561c-42c6-8c04-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">94d49232f1d77611544371826be16a99</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-4b54-448c-9154-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: fd903f9471e7b3f60739b8f29fec041d (MISP Attribute #17557)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: fd903f9471e7b3f60739b8f29fec041d (MISP Attribute #17557)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-4b54-448c-9154-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-4b54-448c-9154-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">fd903f9471e7b3f60739b8f29fec041d</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-5284-4795-9ec0-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: d3ebb760c9de3486379abc3672dbee8b (MISP Attribute #17558)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: d3ebb760c9de3486379abc3672dbee8b (MISP Attribute #17558)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-5284-4795-9ec0-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-5284-4795-9ec0-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">d3ebb760c9de3486379abc3672dbee8b</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-50b8-472a-a1f2-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: 37c9e979a36b31355e779f10ecaba886 (MISP Attribute #17559)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: 37c9e979a36b31355e779f10ecaba886 (MISP Attribute #17559)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-50b8-472a-a1f2-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-50b8-472a-a1f2-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">37c9e979a36b31355e779f10ecaba886</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-36b4-4d66-841e-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: bb0143290d7c9cb1d186e209e4aa8d87 (MISP Attribute #17560)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: bb0143290d7c9cb1d186e209e4aa8d87 (MISP Attribute #17560)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-36b4-4d66-841e-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-36b4-4d66-841e-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">bb0143290d7c9cb1d186e209e4aa8d87</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-32f4-4344-a582-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: e0804de1f0b4a22dbeddc90fb2854bfe (MISP Attribute #17561)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: e0804de1f0b4a22dbeddc90fb2854bfe (MISP Attribute #17561)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-32f4-4344-a582-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-32f4-4344-a582-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">e0804de1f0b4a22dbeddc90fb2854bfe</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-43e8-46ee-941b-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: 4feae73c2ef347692be0068793fc2c73 (MISP Attribute #17562)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: 4feae73c2ef347692be0068793fc2c73 (MISP Attribute #17562)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-43e8-46ee-941b-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-43e8-46ee-941b-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">4feae73c2ef347692be0068793fc2c73</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-46cc-473a-aaaa-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: 46cab66af42f40c9f65fa20bf071601f (MISP Attribute #17563)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: 46cab66af42f40c9f65fa20bf071601f (MISP Attribute #17563)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-46cc-473a-aaaa-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-46cc-473a-aaaa-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">46cab66af42f40c9f65fa20bf071601f</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-2ebc-4c0e-b1c2-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: 8a20147b5df86ea6bdd39b9ea84dfc2d (MISP Attribute #17564)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: 8a20147b5df86ea6bdd39b9ea84dfc2d (MISP Attribute #17564)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-2ebc-4c0e-b1c2-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-2ebc-4c0e-b1c2-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">8a20147b5df86ea6bdd39b9ea84dfc2d</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-2778-4784-b22c-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: c616f271a456eb2c54bdbee67fb88eda (MISP Attribute #17565)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: c616f271a456eb2c54bdbee67fb88eda (MISP Attribute #17565)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-2778-4784-b22c-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-2778-4784-b22c-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">c616f271a456eb2c54bdbee67fb88eda</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-3b28-4b81-9e4b-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: 19dfff93ad650c02fbffa73faea48a96 (MISP Attribute #17566)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: 19dfff93ad650c02fbffa73faea48a96 (MISP Attribute #17566)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-3b28-4b81-9e4b-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-3b28-4b81-9e4b-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">19dfff93ad650c02fbffa73faea48a96</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-57d4-4f8b-acc0-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: eaf569c0d8866df41f6c419b6683946b (MISP Attribute #17567)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: eaf569c0d8866df41f6c419b6683946b (MISP Attribute #17567)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-57d4-4f8b-acc0-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-57d4-4f8b-acc0-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">eaf569c0d8866df41f6c419b6683946b</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-6864-4d94-b9e1-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: 2f9911e69ee7eeb2db050f82da85688e (MISP Attribute #17568)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: 2f9911e69ee7eeb2db050f82da85688e (MISP Attribute #17568)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-6864-4d94-b9e1-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-6864-4d94-b9e1-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">2f9911e69ee7eeb2db050f82da85688e</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-7764-435a-bc52-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: 1b6ef8b512ab768d76999d81387eeca6 (MISP Attribute #17569)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: 1b6ef8b512ab768d76999d81387eeca6 (MISP Attribute #17569)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-7764-435a-bc52-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-7764-435a-bc52-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">1b6ef8b512ab768d76999d81387eeca6</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-7a48-4aef-8735-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: 370db91c6eca64f63083d577049bba5b (MISP Attribute #17570)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: 370db91c6eca64f63083d577049bba5b (MISP Attribute #17570)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-7a48-4aef-8735-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-7a48-4aef-8735-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">370db91c6eca64f63083d577049bba5b</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-64f4-4a1a-8a35-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: dd9826b9dc747f625015d24ccd22acd6 (MISP Attribute #17571)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: dd9826b9dc747f625015d24ccd22acd6 (MISP Attribute #17571)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-64f4-4a1a-8a35-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-64f4-4a1a-8a35-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">dd9826b9dc747f625015d24ccd22acd6</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-c1b0-4ee1-a1b4-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: 14465588c4b201fcb03366292b1112d8 (MISP Attribute #17572)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: 14465588c4b201fcb03366292b1112d8 (MISP Attribute #17572)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-c1b0-4ee1-a1b4-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-c1b0-4ee1-a1b4-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">14465588c4b201fcb03366292b1112d8</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-f11c-4695-a426-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: a3125fdc709ff73ecf75447095fe4aa5 (MISP Attribute #17573)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: a3125fdc709ff73ecf75447095fe4aa5 (MISP Attribute #17573)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-f11c-4695-a426-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-f11c-4695-a426-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">a3125fdc709ff73ecf75447095fe4aa5</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-ee88-42ff-a6c6-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: 9cecb0bd8ccf9be70a1a24c729514bda (MISP Attribute #17574)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: 9cecb0bd8ccf9be70a1a24c729514bda (MISP Attribute #17574)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-ee88-42ff-a6c6-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-ee88-42ff-a6c6-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">9cecb0bd8ccf9be70a1a24c729514bda</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-c4e4-41c1-8e91-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: eb45d72b786904fe7e5e2376b845061d (MISP Attribute #17575)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: eb45d72b786904fe7e5e2376b845061d (MISP Attribute #17575)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-c4e4-41c1-8e91-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-c4e4-41c1-8e91-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">eb45d72b786904fe7e5e2376b845061d</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-b8f0-4e75-95f4-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: e220361db365f017583705ec341bd15b (MISP Attribute #17576)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: e220361db365f017583705ec341bd15b (MISP Attribute #17576)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-b8f0-4e75-95f4-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-b8f0-4e75-95f4-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">e220361db365f017583705ec341bd15b</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-cfc0-480c-8223-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: 3c124dfd026c71b6035beb5c2499ae26 (MISP Attribute #17577)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: 3c124dfd026c71b6035beb5c2499ae26 (MISP Attribute #17577)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-cfc0-480c-8223-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-cfc0-480c-8223-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">3c124dfd026c71b6035beb5c2499ae26</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-cfe8-4f1e-8e8a-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: 74d5c71cc073ccedafefcb10fde91e04 (MISP Attribute #17578)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: 74d5c71cc073ccedafefcb10fde91e04 (MISP Attribute #17578)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-cfe8-4f1e-8e8a-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-cfe8-4f1e-8e8a-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">74d5c71cc073ccedafefcb10fde91e04</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9c5-d0d8-4264-92c7-11098e96ca05" timestamp="2017-12-06T09:08:05+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: ae2161510ef99f71afaa7cf69a8f814c (MISP Attribute #17579)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: ae2161510ef99f71afaa7cf69a8f814c (MISP Attribute #17579)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9c5-d0d8-4264-92c7-11098e96ca05">
|
|
<cybox:Object id=":File-5a27f9c5-d0d8-4264-92c7-11098e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">ae2161510ef99f71afaa7cf69a8f814c</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:05+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27fa44-40d8-4732-94b1-11098e96ca05" timestamp="2017-12-06T09:10:12+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: PerfIPC (MISP Attribute #17590)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Host Characteristics</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: PerfIPC (MISP Attribute #17590)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27fa44-40d8-4732-94b1-11098e96ca05">
|
|
<cybox:Object id=":Mutex-5a27fa44-40d8-4732-94b1-11098e96ca05">
|
|
<cybox:Properties xsi:type="MutexObj:MutexObjectType">
|
|
<MutexObj:Name condition="Equals">PerfIPC</MutexObj:Name>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:10:12+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27fa44-0978-4448-9bf1-11098e96ca05" timestamp="2017-12-06T09:10:12+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: STORAGE_MUTEX (MISP Attribute #17591)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Host Characteristics</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: STORAGE_MUTEX (MISP Attribute #17591)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27fa44-0978-4448-9bf1-11098e96ca05">
|
|
<cybox:Object id=":Mutex-5a27fa44-0978-4448-9bf1-11098e96ca05">
|
|
<cybox:Properties xsi:type="MutexObj:MutexObjectType">
|
|
<MutexObj:Name condition="Equals">STORAGE_MUTEX</MutexObj:Name>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:10:12+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27fa44-438c-497a-b355-11098e96ca05" timestamp="2017-12-06T09:10:12+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: Global\76467a526e3f430f870f2d48876b77b7 (MISP Attribute #17592)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Host Characteristics</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: Global\76467a526e3f430f870f2d48876b77b7 (MISP Attribute #17592)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27fa44-438c-497a-b355-11098e96ca05">
|
|
<cybox:Object id=":Mutex-5a27fa44-438c-497a-b355-11098e96ca05">
|
|
<cybox:Properties xsi:type="MutexObj:MutexObjectType">
|
|
<MutexObj:Name condition="Equals">Global\76467a526e3f430f870f2d48876b77b7</MutexObj:Name>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:10:12+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27fa44-c94c-405b-b213-11098e96ca05" timestamp="2017-12-06T09:10:12+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: Global\6efa80dda7d8489f931cc9b2eac58777 (MISP Attribute #17593)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Host Characteristics</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: Global\6efa80dda7d8489f931cc9b2eac58777 (MISP Attribute #17593)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27fa44-c94c-405b-b213-11098e96ca05">
|
|
<cybox:Object id=":Mutex-5a27fa44-c94c-405b-b213-11098e96ca05">
|
|
<cybox:Properties xsi:type="MutexObj:MutexObjectType">
|
|
<MutexObj:Name condition="Equals">Global\6efa80dda7d8489f931cc9b2eac58777</MutexObj:Name>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:10:12+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27fa36-8c68-4682-ab5c-11098e96ca05" timestamp="2017-12-06T09:09:58+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: \\.\pipe\BrowseIPC (MISP Attribute #17588)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Host Characteristics</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: \\.\pipe\BrowseIPC (MISP Attribute #17588)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27fa36-8c68-4682-ab5c-11098e96ca05">
|
|
<cybox:Object id=":Pipe-5a27fa36-8c68-4682-ab5c-11098e96ca05">
|
|
<cybox:Properties xsi:type="PipeObj:PipeObjectType">
|
|
<PipeObj:Name condition="Equals">\\.\pipe\BrowseIPC</PipeObj:Name>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:09:58+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Artifacts dropped</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27fa36-4e00-4a43-9aa1-11098e96ca05" timestamp="2017-12-06T09:09:58+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Artifacts dropped: \\.\pipe\{82221195-6222-4854-8874-016aa4e9dd41} (MISP Attribute #17589)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Host Characteristics</indicator:Type>
|
|
<indicator:Description>Artifacts dropped: \\.\pipe\{82221195-6222-4854-8874-016aa4e9dd41} (MISP Attribute #17589)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27fa36-4e00-4a43-9aa1-11098e96ca05">
|
|
<cybox:Object id=":Pipe-5a27fa36-4e00-4a43-9aa1-11098e96ca05">
|
|
<cybox:Properties xsi:type="PipeObj:PipeObjectType">
|
|
<PipeObj:Name condition="Equals">\\.\pipe\{82221195-6222-4854-8874-016aa4e9dd41}</PipeObj:Name>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:09:58+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">None</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27fa29-2f2c-428e-971b-11098e96ca05" timestamp="2017-12-06T09:09:45+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: pssts1.nozonenet.com (MISP Attribute #17585)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: pssts1.nozonenet.com (MISP Attribute #17585)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27fa29-2f2c-428e-971b-11098e96ca05">
|
|
<cybox:Object id=":DomainName-5a27fa29-2f2c-428e-971b-11098e96ca05">
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
|
<DomainNameObj:Value condition="Equals">pssts1.nozonenet.com</DomainNameObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:09:45+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27fa29-c180-4131-8e5d-11098e96ca05" timestamp="2017-12-06T09:09:45+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: time-local.com (MISP Attribute #17586)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: time-local.com (MISP Attribute #17586)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27fa29-c180-4131-8e5d-11098e96ca05">
|
|
<cybox:Object id=":DomainName-5a27fa29-c180-4131-8e5d-11098e96ca05">
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
|
<DomainNameObj:Value condition="Equals">time-local.com</DomainNameObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:09:45+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27fa29-36d8-4b5e-bef3-11098e96ca05" timestamp="2017-12-06T09:09:45+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: time-local.net (MISP Attribute #17587)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: time-local.net (MISP Attribute #17587)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27fa29-36d8-4b5e-bef3-11098e96ca05">
|
|
<cybox:Object id=":DomainName-5a27fa29-36d8-4b5e-bef3-11098e96ca05">
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
|
<DomainNameObj:Value condition="Equals">time-local.net</DomainNameObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:09:45+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27fac9-1f90-405a-8145-11098e96ca05" timestamp="2017-12-06T09:12:25+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: pupki.co (MISP Attribute #17594)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: pupki.co (MISP Attribute #17594)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27fac9-1f90-405a-8145-11098e96ca05">
|
|
<cybox:Object id=":DomainName-5a27fac9-1f90-405a-8145-11098e96ca05">
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
|
<DomainNameObj:Value condition="Equals">pupki.co</DomainNameObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:12:25+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a281504-1720-4c8f-90c1-11098e96ca05" timestamp="2017-12-06T11:04:20+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: eastafro.net (MISP Attribute #17595)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: eastafro.net (MISP Attribute #17595)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a281504-1720-4c8f-90c1-11098e96ca05">
|
|
<cybox:Object id=":DomainName-5a281504-1720-4c8f-90c1-11098e96ca05">
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
|
<DomainNameObj:Value condition="Equals">eastafro.net</DomainNameObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T11:04:20+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a281504-7ee0-446f-bd09-11098e96ca05" timestamp="2017-12-06T11:04:20+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: getadobeplayer.com (MISP Attribute #17596)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: getadobeplayer.com (MISP Attribute #17596)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a281504-7ee0-446f-bd09-11098e96ca05">
|
|
<cybox:Object id=":DomainName-5a281504-7ee0-446f-bd09-11098e96ca05">
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
|
<DomainNameObj:Value condition="Equals">getadobeplayer.com</DomainNameObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T11:04:20+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a281504-f94c-4e52-8866-11098e96ca05" timestamp="2017-12-06T11:04:20+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: diretube.co.uk (MISP Attribute #17597)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: diretube.co.uk (MISP Attribute #17597)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a281504-f94c-4e52-8866-11098e96ca05">
|
|
<cybox:Object id=":DomainName-5a281504-f94c-4e52-8866-11098e96ca05">
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
|
<DomainNameObj:Value condition="Equals">diretube.co.uk</DomainNameObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T11:04:20+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a281504-6d78-458c-834f-11098e96ca05" timestamp="2017-12-06T11:04:20+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: meskereme.net (MISP Attribute #17598)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: meskereme.net (MISP Attribute #17598)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a281504-6d78-458c-834f-11098e96ca05">
|
|
<cybox:Object id=":DomainName-5a281504-6d78-458c-834f-11098e96ca05">
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
|
<DomainNameObj:Value condition="Equals">meskereme.net</DomainNameObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T11:04:20+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9f0-b9fc-4809-bbdb-11098e96ca05" timestamp="2017-12-06T09:08:48+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: https://pssts1.nozonenet.com/ts8/ts8.php (MISP Attribute #17580)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: https://pssts1.nozonenet.com/ts8/ts8.php (MISP Attribute #17580)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9f0-b9fc-4809-bbdb-11098e96ca05">
|
|
<cybox:Object id=":URI-5a27f9f0-b9fc-4809-bbdb-11098e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://pssts1.nozonenet.com/ts8/ts8.php</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:48+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9f0-8b98-4c33-bfce-11098e96ca05" timestamp="2017-12-06T09:08:48+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: https://time-local.com/ (MISP Attribute #17581)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: https://time-local.com/ (MISP Attribute #17581)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9f0-8b98-4c33-bfce-11098e96ca05">
|
|
<cybox:Object id=":URI-5a27f9f0-8b98-4c33-bfce-11098e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://time-local.com/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:48+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9f0-de2c-4a55-91a9-11098e96ca05" timestamp="2017-12-06T09:08:48+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: https://time-local.net/ (MISP Attribute #17582)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: https://time-local.net/ (MISP Attribute #17582)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9f0-de2c-4a55-91a9-11098e96ca05">
|
|
<cybox:Object id=":URI-5a27f9f0-de2c-4a55-91a9-11098e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://time-local.net/</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:48+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9f0-ff88-4631-90ae-11098e96ca05" timestamp="2017-12-06T09:08:48+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: https://time-local.com/ts.php (MISP Attribute #17583)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: https://time-local.com/ts.php (MISP Attribute #17583)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9f0-ff88-4631-90ae-11098e96ca05">
|
|
<cybox:Object id=":URI-5a27f9f0-ff88-4631-90ae-11098e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://time-local.com/ts.php</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:48+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-5a27f9f0-0654-4388-adcc-11098e96ca05" timestamp="2017-12-06T09:08:48+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: https://time-local.net/ts.php (MISP Attribute #17584)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">URL Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: https://time-local.net/ts.php (MISP Attribute #17584)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-5a27f9f0-0654-4388-adcc-11098e96ca05">
|
|
<cybox:Object id=":URI-5a27f9f0-0654-4388-adcc-11098e96ca05">
|
|
<cybox:Properties xsi:type="URIObj:URIObjectType">
|
|
<URIObj:Value condition="Equals">https://time-local.net/ts.php</URIObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Confidence timestamp="2017-12-06T09:08:48+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
</incident:Related_Indicators>
|
|
<incident:History>
|
|
<incident:History_Item>
|
|
<incident:Journal_Entry time_precision="second">Event Threat Level: High</incident:Journal_Entry>
|
|
</incident:History_Item>
|
|
<incident:History_Item>
|
|
<incident:Journal_Entry time_precision="second">MISP Tag: TLP:WHITE</incident:Journal_Entry>
|
|
</incident:History_Item>
|
|
</incident:History>
|
|
<incident:Information_Source>
|
|
<stixCommon:Identity>
|
|
<stixCommon:Name>citizenlab</stixCommon:Name>
|
|
</stixCommon:Identity>
|
|
<stixCommon:References>
|
|
<stixCommon:Reference>https://citizenlab.ca/2017/12/champing-cyberbit-ethiopian-dissidents-targeted-commercial-spyware/</stixCommon:Reference>
|
|
</stixCommon:References>
|
|
</incident:Information_Source>
|
|
<incident:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
|
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="GREEN"/>
|
|
</marking:Marking>
|
|
</incident:Handling>
|
|
</stix:Incident>
|
|
</stix:Incidents>
|
|
</stix:Package>
|
|
</stix:Related_Package>
|
|
</stix:Related_Packages>
|
|
</stix:STIX_Package>
|